Connect Airtable to Lutril
Lutril connects to Airtable with a personal access token belonging to an enterprise admin. It lists every member of your enterprise over SCIM and enriches each one from the Enterprise API with their state, their last activity, their admin rights and whether your enterprise actually manages the account. Access is time boxed through Airtable's own reversible deactivation: a grant provisions the account or reinstates one Lutril deactivated earlier, and the deadline deactivates it again. Workspace and base collaborations survive, so reinstating somebody gives them back exactly what they had.
Access requested
- enterprise.scim.usersAndGroups:manage (list the enterprise over SCIM, and provision a new account). SCIM is the only endpoint that can enumerate an enterprise, because the Enterprise API can only answer about people you can already name.
- enterprise.user:read (each member's state, last activity, admin rights and managed flag)
- enterprise.user:write (deactivate an account at a deadline, and reinstate it on the next request)
Setup steps
- 1
Sign in to Airtable as an enterprise admin and open the personal access token page. If you administer more than one enterprise, use a service account's token instead so the calls are not tied to one person.
Create an Airtable token - 2
Create a token named something like Lutril and add three scopes: enterprise.scim.usersAndGroups:manage, enterprise.user:read and enterprise.user:write. Nothing else is needed. Lutril never reads your bases, tables or records.
Airtable API scopes - 3
Copy the token when it appears. Airtable shows it once.
- 4
Find your enterprise account ID. It is the entXXXXXXXXXXXXXX value in the address of your Airtable admin panel.
Airtable admin panel overview - 5
In Lutril, connect Airtable, paste the token and the enterprise account ID. The token is encrypted at rest.
- 6
Check your plan before relying on time boxed access. Listing users over SCIM needs a Business plan or above, and deactivating or reinstating an account needs Enterprise or Enterprise Scale. On a Business plan Lutril will show you the roster and access reviews, and tell you plainly that it cannot deactivate.
Deactivating and reactivating users - 7
Accounts are created without a password. Airtable provisions SCIM users for single sign on only, so Lutril never generates a password and has nothing to send anyone. The person signs in through your identity provider.
- 8
Lutril never calls Airtable's delete endpoint. The only removal it performs is the reversible one: deactivation revokes the licence and blocks sign in while keeping the account, and reinstating it restores the workspaces and bases the person was part of. Deleting a user stays a deliberate action in the Airtable admin panel.
- 9
Airtable refuses a state change on four kinds of account: your own, an external user, a free login account, and any user your enterprise does not manage because the domain is not claimed. Lutril reports which of the four applies rather than passing Airtable's error code on to whoever asked.
- 10
Service accounts are listed as service accounts and read only share link users as such, rather than all being folded into Member. That keeps an access review about the people who actually hold access.
Where to create it
Official docs
Sign in to Lutril to connect Airtable, or book a demo and we set it up with you. No slides.